Placement and Access (P&A) | Attack the Glass

Every ATG operation begins with a position. An adversary who has not acquired a node from which content, code, configuration, or data reaches a Client Runtime cannot run the operation; an adversary who has acquired one can run it at the moment of choosing. That position is Placement and Access (P&A).

The position is platform-agnostic. A browser tab, a mobile WebView, a mobile app shell built on a cross-platform framework such as React Native or Flutter, a desktop application built on a web runtime such as Electron or Tauri, a developer IDE, an AI chatbot interface, a smart-television runtime, a vehicle infotainment system, an IoT or industrial control dashboard, an AR/VR scene, a productivity-tool plugin host, an interactive UGC runtime: in every one of them an adversary can take the same kinds of position, and in every one the switch from a dormant position to a live operation works the same way.

11.1: P&A Defined and the Causal Chain

Placement and Access (P&A) is the structural condition of occupying a position from which content, code, data, or configuration delivered to a target can be controlled, modified, or substituted. The position does not depend on any particular exploit or technique: whoever holds it can act on what gets delivered, at a time of their choosing, whether or not they ever do. An exploit, when one comes, is simply the position being used; without the position there is nothing to use.

The position takes any of five forms:

Technical: control of an infrastructure component the supply chain depends on, such as a CDN node, a DNS server, a build system, or a runtime endpoint.
Corporate: control of an entity that owns or operates such a component, including the parent company, the holding entity, or the acquired subsidiary.
Human: insider access by a maintainer, administrator, or operator holding legitimate credentials.
Physical: location-based access to hardware, cabling, or facilities.
Coercive: compelled cooperation from an actor who would otherwise resist. Sophisticated operations will layer and combine multiple P&A positions. A position turns into an effect in three stages, each one a step up from the one before:
Placement and Access: the actor occupies the position and can operate it. Holding the position is not the same as using it: it can sit dormant for any length of time before anything a defender could observe happens.
Influence: what builds up as the actor uses the position repeatedly and across more of what passes through it. The systems fed from that position, the content they show, and the decisions people make on the strength of that content all start to move the way the actor wants.
Control: Influence held over a whole population long enough that the actor's choices decide how the systems behave for the dependent set, every application and user relying on that infrastructure, rather than merely nudging that behavior. How much Control an actor can reach depends on how good the position is and how long the actor keeps using it. A weak position exercised briefly produces transient Influence at most. A strong position exercised consistently produces Control over the dependent population.

11.2: Levels of Control

Control rises with the quality of the position that produces it. Five levels run from a one-off effect on a single request up to control of infrastructure that many systems sit on:

Transient influence over a single request: the position influences one interaction. A network-path adversary who alters one response and then loses position has acted at this level.
Persistent influence over a defined user population: the position consistently shapes outcomes for a population that depends on the affected resource. A compromised analytics script delivered through a CDN reaches every page of every property using that CDN, every load.
Selective control over content delivered to targeted individuals: the position lets the actor change what one chosen person receives, provided the actor knows enough about that person to pick them out and reach them. An operation that ships different content based on geographic IP, device fingerprint, or authenticated user identifier acts at this level.
Full control over the information environment of a dependent system: the position shapes everything the dependent system sees and processes. An adversary holding a vehicle's over-the-air update channel, the path by which new code is pushed straight to the car without passing through a dealer or an app store, decides what the head unit displays, requests, and accepts.
Systemic control over the infrastructure layer on which many dependent systems rely: the position affects an entire infrastructure category and every system that depends on it. An adversary at a top-tier app store, a major mobile carrier's update channel, or a TLS root CA reaches the population of every dependent application. Reaching each level takes a position of matching quality, and how far the adversary actually pushes it is their own choice. A CDN-level position enables application-scoped D5 effects; a device-level position enables cross-application D5 effects; an ISP-level position enables network-wide D5 effects; a platform-level position enables ecosystem-wide D5 effects. The position determines what is reachable; the operator decides whether to reach for it.

11.3: P&A as Injection Point in Supply Chains

Every P&A position established within a supply chain is an injection point. The injection point comes with the position itself rather than with any exploit; it lasts as long as the position lasts, and it is open to whoever holds the position, whatever technique they choose.

Seeing the position this way changes what a defender should watch for. A defender watching for exploit signatures is monitoring an Adversarial Influence Operation (AIO), the activation phase, rather than Adversarial Placement and Access (APA), the underlying capability. By the time a signature appears, the position has already been held long enough to deliver. The position is the threat; the activation is one expression of it.

11.4: The Influence and Control Monitoring Imperative

Defenders must continuously know who influences or controls each piece of infrastructure delivering content, code, or data to the rendering layer. Who owns it, who governs it, who staffs it, which legal jurisdictions it answers to, and who runs it day to day all count, because any one of them can be used to change what gets delivered. Whatever a defender does not watch is where the position can be taken or handed on unseen.

This is what Malice Without Malware means in practice for the supply chain: an adversary can change what a device receives without ever shipping code a scanner would call malicious. Finding malicious code is necessary but not enough. The broader job is knowing who influences and controls the supply chain.

11.5: APA and AIO

Adversarial Placement and Access (APA) names the case where the actor holding a P&A position is hostile to the dependent set. Adversarial Influence Operation (AIO) names the activity by which an APA holder uses the position against that set. Holding a position and acting through it are separate things: an adversary can do the first for years without ever doing the second.

Many P&A positions exist legitimately. CDN operators, package maintainers, infrastructure providers, registry administrators, and credential authorities all hold P&A by design; the position is what makes their service possible. The position is the same in both cases; what differs is the holder.

An AIO selects targets, delivers content, code, or behavior through the controlled node, and manages duration, reach, and detectability. Running an AIO is what an APA position is held for; until one is run, the position is capability sitting idle.

Distinguishing APA from AIO matters for policy, detection, and response. The defender may observe an AIO without knowing about the APA that produced it. The defender may identify an APA before any AIO has been launched. The two situations are not interchangeable; the defenses that fit one do not fit the other.

11.6: The Activation Event

The activation event is the moment dormant APA produces a detectable effect. Until then the position gives a defender nothing to find: the traffic, the logs, and the behavior all look the same as a legitimate operator running the same infrastructure. Activation is typically the earliest moment at which a defender can observe the operation.

Policy and architecture that focus only on the activation event miss the APA window entirely. By the time activation is observable, the position has already been held long enough to gather intelligence, prepare payloads, and shape the infrastructure for the operation to come. Rules that make an organization track who owns and controls its infrastructure, before anything has been launched through it, act on the APA phase instead.

11.7: The Scope Hierarchy

P&A operates at five scopes:

Component: a single script, package, or library.
Application: an entire application's delivery infrastructure.
Platform: a CDN, cloud provider, app store, OTA update channel, plugin marketplace, or distribution channel serving many applications across one or more host Client Runtime platforms.
Device: a position on the target device itself: laptop, phone, vehicle head unit, smart-TV, IoT controller, or an embedded control panel.
Infrastructure: a position in the network path between server and client. Each level widens what an adversary can reach, and a position at one level helps win positions at the others. An adversary with P&A at one level uses it to achieve P&A at additional levels: a supply-chain position that profiles devices enables targeted device-level P&A; a device-level position that observes credentials enables platform-level P&A. The Polyfill.io operation ran this pattern in confirmed form, using platform-level CDN access to profile visiting devices and selectively redirect a subset to an exploit site. Each position creates intelligence that enables the next; a sustained operation accumulates positions across multiple levels rather than holding one.

11.8: The APA Vector Landscape

A vector is a position an adversary can occupy. A pathway is a route by which the adversary gets to it. The two are independent of each other: any position can be reached by any route, and most real campaigns use several of each. The APA Vector Landscape spans nineteen categories, organized by infrastructure layer:

Foundation and platform layer: hardware, firmware, OS and kernels, hypervisors and virtualization, container runtimes.
Network and transit layer: the largest backbone carriers, mobile carriers and SIM/eSIM providers, the internet exchange points where networks hand traffic to each other, BGP and routing, VPN and proxy services, Wi-Fi infrastructure, web application firewalls, DDoS mitigation, edge compute.
DNS, naming, and trust layer: registrars, authoritative DNS, recursive resolvers, TLS certificate authorities, certificate transparency logs, cryptographic libraries, hardware security modules and key management services, secrets managers.
Cloud and hosting layer: IaaS, PaaS, and SaaS providers; managed Kubernetes; serverless platforms; database-as-a-service; managed storage and object stores.
Code, build, and software distribution layer: package registries, source repositories, CI/CD pipelines, container image registries, code-signing infrastructure, software-update servers.
Identity and access layer: identity providers, SSO and federation services (SAML, OIDC), OAuth providers, MFA services, directory services, privileged access management.
Web application front-end supply chain (the IOTG layer): CDN-hosted libraries, third-party scripts, tag managers (the tools that load other companies' scripts into a page), ad and analytics SDKs, font and asset hosts, embedded widgets.
Embedded third-party services and widgets: chat and support widgets, video players, social-media embeds, comment platforms, payment widgets.
Payments and commerce: payment processors, gateway providers, tokenization services, fraud-prevention vendors, e-commerce platforms.
Marketing, advertising, and tracking ecosystem: ad networks, demand-side and supply-side platforms, audience platforms, RTB exchanges, attribution and analytics platforms.
Data and reference services: weather, location, mapping, currency, market-data, and reference APIs; data brokers.
AI and ML supply chain: model registries, model providers, inference APIs (the addresses an application calls to get an answer from a model), training-data sources, MLOps pipelines, vector databases.
Communications infrastructure: SMS and email gateways, push-notification services, voice and video providers, messaging APIs, real-time communication platforms.
Mobile-specific supply chain: app stores, in-app purchase platforms, mobile SDK vendors, mobile-specific analytics, OTA hot-update services.
Endpoint security and management: endpoint detection and response vendors, mobile device management platforms, antivirus, endpoint configuration tools, vulnerability scanners.
Operations, observability, and infrastructure tooling: application performance monitoring, logging, monitoring, error reporting, feature-flag services, configuration management.
Standards, governance, and registry layer: standards bodies, certificate authorities (root and intermediate), domain registries, technical-spec governance.
Adjacent service ecosystems with privileged access: enterprise SaaS with administrative rights, including CRM, ITSM, document management, and productivity suites.
IoT and operational technology supply chain: device firmware vendors, OTA update channels, telemetry and control platforms, industrial control systems, smart-home platforms. The supply chain really does run this wide. Every one of these categories holds positions that become injection points once an adversary occupies them. Few defenders can see into all nineteen, and adversaries pick the ones nobody is watching.

11.9: P&A Acquisition Pathways

Adversaries acquire P&A through seven pathways. None of them is new to supply-chain security; what changes with ATG is what each one buys the adversary at the rendering layer:

Technical infrastructure control: CDN, DNS, hosting, ISP, TLS CA, Wi-Fi network compromise.
Software supply-chain control: package takeover, third-party script hosting, data endpoint compromise, CI/CD pipeline, code repository, container or image registry, AI model supply chain, browser extension acquisition.
Corporate and organizational control: acquisition of entity, board or governance influence, investment leverage, vendor and contractor relationships, joint venture access, standards body influence. Because buying a company is a lawful transaction, this route can be taken with a signature rather than an exploit; the Funnull/Polyfill.io acquisition is the clearest case.
Human factors: insider placement, insider recruitment, developer or maintainer targeting, social engineering of access processes, third-party personnel with infrastructure access. The Open-Source Open Door is the version of this that costs an adversary the least: an unpaid maintainer, with no security team behind them, holding publishing rights over code that runs everywhere.
Physical access: data center, network infrastructure, hardware supply chain interception, endpoint device access.
Coercion, extortion, and hostile action: extortion of operators, coerced insider action, jurisdictional coercion, criminal acquisition through fronts, physical intimidation, blackmail. Corporate acquisition and coercion combine readily: control of what an operator's infrastructure delivers passes with the asset, whether the transfer was bought or forced.
Communication and distribution channels: app stores, update and patch distribution, email and messaging infrastructure, content delivery and caching infrastructure. Pathways combine. Most documented operations use two or more, and the choice depends on the defenses the adversary faces.

11.10: Operational Characteristics

An APA position behaves in three ways worth naming separately. Dormancy, persistence, and escalation are well-documented adversary tradecraft generally; each takes a particular form here:

Dormancy: until the adversary acts, the position produces nothing a defender could flag. This is what defeats checking a file before it is delivered: at the moment of the check nothing is wrong, so the check passes, and the position is what defenders have to watch instead.
Persistence and resilience: APA positions are designed to survive personnel changes, infrastructure migrations, security audits, and vendor reviews. Redundant APA across multiple vectors is the operational reality, not the exception.
Escalation: each P&A position is both a capability in itself and the intelligence that makes the next one reachable. That is how APA spreads across the five levels of scope. Sustained operations carry all three by design.

11.11: The Cross-Surface Attack Model

Every digital asset has more than a digital surface. It has a physical presence (a server in a building, a cable in a conduit, a device on a desk), a legal owner (a person, a corporation, or a trust), a financial structure (investors, creditors, acquirers), and a human operator (a developer, an administrator, or an executive).

An adversary can obtain P&A in the digital supply chain by attacking any of these surfaces, not only the digital one. Control taken through one of these surfaces is worth exactly as much as control taken through any other, because the end state is the same. Defending one surface does nothing for the rest, and an attack that lands on one carries into them.

Lateral movement across surfaces is the operational reality. Financial leverage leads to corporate control, then to technical access, then to digital P&A. Physical access leads to credential theft, then to infrastructure control, then to supply-chain position. Social engineering leads to insider recruitment, then to code repository access, then to deployed adversarial capability. The digital supply chain is reachable from all of them.

The same point can be stated as a rule about ownership. However abstract or widely distributed a digital supply-chain component looks, it runs on equipment that belongs to a company, and that company is run by people who live somewhere and answer to the law of that place. The adversary who can exert control over the person, the entity, or the jurisdiction can obtain control over the digital asset without executing any technical exploit against the digital asset itself.

P&A names what makes ATG operations possible. The position lives across five surfaces, not one. A defense that reaches only the digital surface reaches only a fraction of the threat.